https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 19 Oct 2026 07:28:56 +0000 https://cve.radiocsirt.org/vuln/cve-2026-3649 <p><strong>Affected:</strong> colbeinformatik Katalogportal-pdf-sync Widget</p> <p>The Katalogportal PDF Sync plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 1.0.0. The katalogportal_popup_shortcode() function is registered as an AJAX handler via wp_ajax_katalogportal_shortcodePrinter but lacks any capability check (current_user_can()) or nonce verification. This allows any authenticated user, including Subscribers, to call the endpoint and retrieve a list of all synchronized PDF attachments (including those attached to private or draft posts) along with their titles, actual filenames, and the katalogportal_userid configuration value. The WP_Query uses post_status =&gt; &#39;any&#39; which returns attachments regardless of the parent post&#39;s visibility status.</p> <p><strong>Affected:</strong> colbeinformatik Katalogportal-pdf-sync Widget</p> <p>The Katalogportal PDF Sync plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 1.0.0. The katalogportal_popup_shortcode() function is registered as an AJAX handler via wp_ajax_katalogportal_shortcodePrinter but lacks any capability check (current_user_can()) or nonce verification. This allows any authenticated user, including Subscribers, to call the endpoint and retrieve a list of all synchronized PDF attachments (including those attached to private or draft posts) along with their titles, actual filenames, and the katalogportal_userid configuration value. The WP_Query uses post_status =&gt; &#39;any&#39; which returns attachments regardless of the parent post&#39;s visibility status.</p> https://cve.radiocsirt.org/vuln/cve-2026-3649